github-advanced-security[bot] commented on code in PR #20521:
URL: https://github.com/apache/druid/pull/20521#discussion_r4219231955
##########
processing/src/test/java/org/apache/druid/java/util/http/client/io/AppendableByteArrayInputStreamTest.java:
##########
@@ -211,6 +211,55 @@
Assertions.assertEquals(-1, in.read());
}
+ @Test
+ public void testAvailableSaturatesInsteadOfOverflowing() throws Exception
+ {
+ final AppendableByteArrayInputStream in = new
AppendableByteArrayInputStream();
+
+ // The same array is queued repeatedly: the stream retains references, so
this accounts for 2 GiB of queued
+ // bytes while allocating only one chunk.
+ final byte[] oneMebibyte = new byte[1024 * 1024];
+ for (int i = 0; i < 2048; i++) {
+ in.add(oneMebibyte);
+ }
+
+ Assertions.assertEquals(Integer.MAX_VALUE, in.available());
+
+ in.read(new byte[oneMebibyte.length]);
+
+ Assertions.assertEquals((2048L - 1) * oneMebibyte.length, (long)
in.available());
+ }
+
+ @Test
+ public void testExceptionCaughtReleasesQueuedBytes() throws IOException
+ {
+ final AppendableByteArrayInputStream in = new
AppendableByteArrayInputStream();
+ in.add(new byte[10]);
+ in.add(new byte[8192]);
+ Assertions.assertEquals(5, in.read(new byte[5]));
+
+ in.exceptionCaught(new IOException("connection reset"));
+
+ Assertions.assertEquals(0, in.available());
+ Assertions.assertEquals(5, in.read(new byte[5]), "the chunk being read is
still handed out");
+ Assertions.assertEquals(0, in.available());
+ Assertions.assertThrows(IOException.class, () -> in.read(new byte[8192]));
Review Comment:
## CodeQL / Ignored error status of call
Method execute ignores exceptional return value of InputStream.read.
[Show more
details](https://github.com/apache/druid/security/code-scanning/12044)
##########
processing/src/test/java/org/apache/druid/java/util/http/client/io/AppendableByteArrayInputStreamTest.java:
##########
@@ -211,6 +211,55 @@
Assertions.assertEquals(-1, in.read());
}
+ @Test
+ public void testAvailableSaturatesInsteadOfOverflowing() throws Exception
+ {
+ final AppendableByteArrayInputStream in = new
AppendableByteArrayInputStream();
+
+ // The same array is queued repeatedly: the stream retains references, so
this accounts for 2 GiB of queued
+ // bytes while allocating only one chunk.
+ final byte[] oneMebibyte = new byte[1024 * 1024];
+ for (int i = 0; i < 2048; i++) {
+ in.add(oneMebibyte);
+ }
+
+ Assertions.assertEquals(Integer.MAX_VALUE, in.available());
+
+ in.read(new byte[oneMebibyte.length]);
Review Comment:
## CodeQL / Ignored error status of call
Method testAvailableSaturatesInsteadOfOverflowing ignores exceptional return
value of InputStream.read.
[Show more
details](https://github.com/apache/druid/security/code-scanning/12043)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
